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Abstract 

Many current watermarking algorithms insert data in the spatial or transform 
domains like the discrete cosine, the discrete Fourier, and the discrete wavelet trans- 
forms. In this paper, we present a data-hiding algorithm that exploits the singular 
value decomposition (SVD) representation of the data. We compute the SVD of the 
host image and the watermark and embed the watermark in the singular vectors of 
the host image. The proposed method leads to an imperceptible scheme for digital 
images, both in grey scale and color and is quite robust against attacks like noise 
and JPEG compression. 
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1 Introduction 



In the past one decade, there has been 
a phenomenal increase in the use and 
circulation of information in digital 
multimedia formats for various pur- 
poses. Today, many paintings, pho- 
tographs, newspapers, books, music 
etc., are available over the internet 
in one or the other multimedia for- 
mat. The increasing necessity to pro- 
tect the intellectual property rights 
of such digital content has led to con- 
siderable research in that direction. 
Digital watermarking is one such ap- 
proach. Watermarking is the process 
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of embedding data into a multime- 
dia element such as an image, au- 
dio or video [Langelaar et al. (2000)]. 
This embedded data can later be 
extracted from, or detected in, the 
multimedia for several purposes in- 
cluding copyright protection [Graver 
et al. (1998), Zeng and Liu (1999)], 
trade marks, access control or even to 
simply pass a secret piece of informa- 
tion hidden in an innocuous digital 
image [Zeng (1998), Petitcolas et al. 
(1999)]. A watermarking algorithm 
consists of the watermark structure, 
an embedding algorithm and an ex- 
traction and detection algorithm. 

In this paper, we will be concerned 
with invisible watermarking of the 
digital images. In such images, the 
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basic idea is to embed the watermark 
image in a given host image such that 
the resultant (watermarked) image 
carries the watermark either in visi- 
ble or invisible mode. It is important 
that the watermarked image should 
suffer least corruption due to the 
watermarking procedure. The broad 
strategy, then, is to embed the wa- 
termark, preferably, in the least sig- 
nificant part of the transformed do- 
main of the image. Techniques that 
employ this strategy are the discrete 
cosine transformation (DCT) [Bors 
and Pitas (1996), Dickinson (1997), 
Piva et al. (1997), Piva et al. (1998)] 
and the wavelet transform [Kundur 
and Hatzinakos (1997), Kundur and 
Hatzinakos (1998)] that also hap- 
pen to be most popular [Katzen- 
beisser and Petitcolas (2000)]. The 
DCT allows an image to be broken 
up into different frequency bands, 
making it much easier to embed 
watermarking information into the 
middle frequency bands of an im- 
age. These bands are chosen such 
that they minimize the changes to 
the important parts of the host im- 
age and remain unaffected by var- 
ious image transformations [Lange- 
laar et al. (2000)]. The wavelet trans- 
form approach embodies a similar 
philosophy. The transformed domain 
method, such as this, works well also 
because the embedded data is located 
in that part of the frequency that is 
least sensitive for the human visual 
system hence, the watermark is im- 
perceptible [Lacy et al. (1998), Pran- 
doni and Vetterh (1998), Ohbuchi et 
al. (2002)]. 

However, notice 
that transform methods such as the 



DCT or wavelets attempt to decom- 
pose the image in terms of a standard 
basis set. This need not necessarily 
be the optimal representation for a 
given image. Singular value decom- 
position offers a method by which the 
transformed domain consists of basis 
states that is optimal in some sense; 
i.e., a tailor-made basis for a given 
image. Many of the earlier works us- 
ing SVD for watermarking have at- 
tempted to manipulate the singular 
values of the host and the watermark 
images one way or the other [Liu 
and Tan (2002), Shieh et al. (2005)]. 
Another approach is to perform an 
SVD on various blocks of the im- 
age and then add the scaled singu- 
lar values of the watermark image 
to that of the host image [Gorodet- 
ski et al. (2001)]. For a survey of ex- 
isting watermarking methods using 
SVD, we refer the reader to Ganic 
et al. (2003). In the scheme proposed 
by Chang et al. (2005), both the sin- 
gular values and singular vectors are 
explored for embedding the water- 
mark. A watermarking scheme us- 
ing minimax eigenvalue decomposi- 
tion has been proposed by Davidson 
and Allen (1998). In our algorithm, 
we assume a situation in which those 
who have opted to watermark their 
digital images have access to their 
original images (without the water- 
mark) and the watermark image for 
verification purposes later. This does 
not restrict the applicability of our 
technique as we argue below. In the 
proposed method we work at the level 
of singular vectors and embed the wa- 
termark in the singular vectors of the 
host image. The singular vectors of 
an image of size {m > n) m x n has 
parameters and contains detailed. 
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graded information about the image 
as opposed to just n singular values. 
Hence, in the domain of singular vec- 
tors, we have more latitude to em- 
bed the watermark. We argue that 
this also leads to a level of digital se- 
curity in watermark embedding. We 
also subject our algorithm to tests 
against additive noise, cropping and 
JPEG compression. 

In the next section, we recall the sin- 
gular value decomposition and then 
describe our algorithm. Then, we 
present our numerical simulations in- 
cluding the robustness to several pos- 
sible attacks. 



2 SVD-Based Watermarking 

Singular value decomposition is a 
popular technique in linear algebra 
and it has applications in matrix in- 
version, obtaining low dimensional 
representation for high dimensional 
data, for data compression and even 
data denoising etc., [Golub and Rein- 
sch (1970), Andrews and Patterson 
(1976), Leon (1994)]. If Z is any mxn 
matrix, it is possible to find a decom- 
position of the form 

Z = UDV^, (1) 

where U and V are orthogonal ma- 
trices of order mxn and nxn respec- 
tively. Proof of Eq.(l) can be found 
in many standard linear algebra liter- 
ature [ Strang (1993)]. The diagonal 
matrix D of order nxn has elements 
dii^{i = 1, 2, ..n), which are positive 
definite and are called the singular 



values of D. We do not consider here 
the conditions under which a decom- 
position of type in Eq. (1) will fail for 
image matrices and hence we assume 
that, for all practical purposes, the 
image matrix Z can be decomposed 
in the form given in Eq. (1). Thus the 
SVD can be applied directly to digi- 
tal images represented as matrix ar- 
rays. 



2. 1 Algorithm for embedding water- 
marking in gray scale image 

In this section we present our algo- 
rithm to embed a gray scale image 
into another gray scale image of the 
same size using SVD. Let the ma- 
trix Z represent the host image which 
needs to be watermarked. Let W rep- 
resent the matrix of the image to be 
embedded. As a first step, we com- 
pute the SVD of both Z and W. 

Z = U, D, Vj = A, Vj (2) 

For the watermark image 

W = Uw Vj = Aw Vj (3) 

where A^/^ U^/w 0^/^ are also 
called the principal components in 
the language of principal component 
analysis. 

Now, we add the scaled eigenvector 
Vw of watermark to that of the orig- 
inal image, 

V = V, + AV^ (4) 
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where A is the scahng factor. Typi- 
caUy, < A < 1, so that the inten- 
sity of the watermark W is less com- 
pared to the original image Z. Note 
that, within the framework of SVD, 
Vw = I, where I is the identity 
matrix. Similar relation holds good 
for Vz too. As A ^ 0, the approxima- 
tion that V is a orthogonal matrix, 
i.e, V V I gets better. This prop- 
erty is important in the next step for 
constructing the watermarked image. 
We get the watermarked image as, 

Zc = A, (5) 



rithm given by equations (2-5). Start- 
ing from Eq.(5), we multiply both 
sides of Eq. (5) by A^^ and substitute 

rn 

for V from Eq. (4). It is straight- 
forward to obtain an expression for 
T 

Vw as 

VT = ^-^-^ (6) 

Finally, using Eq. (3), the watermark 
image can be constructed as, 

W = AwVj. (7) 



Thus, equations (2-5) constitute the 
algorithm for watermarking using 
SVD in the eigenvector domain. 

2.2 Algorithm for extracting water- 
marks 

Given the watermarked image Zc, 
we can extract, possibly a corrupted 
watermark, if we have access to the 
matrices Az,Aw,Vz and the value 
of A. That is, we assume that who- 
ever wants to extract the watermark 
should have access to the original 
image as well as the embedded wa- 
termark image. We emphasize that 
this is not a restrictive assumption. 
In most cases, involving copyrights 
and trademarks embedded in digi- 
tal images, the person or organiza- 
tion that embedded the watermark 
in their proprietary digital image will 
have access to both the clean original 
image and the watermark image. 

Extraction algorithm is a straightfor- 
ward reversal of the embedding algo- 



Eq. (7), along with Eq. (6) consti- 
tutes the watermark extraction algo- 
rithm. 

In general, the matrix A^ is not a 
square matrix and by Eq. (6) we are 
required to take its inverse. This com- 
putation is simple because from Eq. 
(2), we have, A^^ = D^^ Uj, where 
inverse of a diagonal matrix and a 
transpose need to be computed. At 
this point, we also stress that if da > 
0, then exists, even if A^ is not 
a square matrix. 

Firstly, note that even though we 
simulate with square images, the 
SVD based method presented above 
can handle rectangular images as 
well, without any changes to the al- 
gorithm. One important extension of 
this algorithm is to address the case 
of color images. We consider the case 
of RGB coded color images. If a color 
image is specified in RGB format 
then it comprises of three component 
matrices superimposed together, one 
each for red, green and blue. It can 
be written as, Z = Zr + Zg + Zb and 
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similarly for the watermark image 
W. We can directly apply this algo- 
rithm to each of the respective com- 
ponent images, {Zr, Wr}, {Zg, Wg} 
and{Zb,Wb}. 

Secondly, the algorithm provides cer- 
tain implicit security features as well. 
The extraction algorithm given by 
Eq. (6) requires the knowledge of 
Az, Vz, Aw Notice that by perform- 
ing a SVD on the watermarked image 
Zc, it might be possible to obtain ap- 
proximate estimates of and Vz. 
However, unless one knows A^ and 
A, it is not possible to extract the 
watermark. This means that if Zc is 
an m X n array, then to hack the 
embedded watermark, one has to es- 
timate mn + 1 independent param- 
eters. This becomes further compli- 
cated due to the fact that the water- 
mark is embedded uniformly in the 
entire host image as given in Eq.(4). 
This is in contrast to the methods 
[Chandra (2002)] where the informa- 
tion about the watermark is embed- 
ded only in n values of the original 
image. 



3 Numerical simulations for 
gray scale image 

In Fig. (1) we show the original Lena 
image, the watermark in Fig. (2), 
the watermarked image in Fig. (3) 
and the extracted watermark in Fig. 
(4). All the images are arrays of size 
128 X 128 and A = 0.2. In Fig. (5), 
we show the absolute difference be- 
tween the original image and the wa- 
termarked image, i.e, Az = |Zc — Z|. 
The embedded watermark is com- 



pletely invisible and we only see a tex- 
ture of the original image. Even for 
larger values of A, we obtain a sim- 
ilar result. This means that even at 
50% strength of watermark image in 
the host image, this method works 
well. As A ^ 0, the approximation 

that V is a orthogonal matrix, i.e, 
T 

V I gets better, is shown by 

the linear graph of diagonal elements 
in Fig. (6). 




Fig. 1. Original Fig. 2. Watermark 
image 128 x 128 image 128 x 128 




Fig. 5. Image difference Az between 
Fig.(l) and Fig.(3) for A = 0.2. 

In order to obtain a global picture of 
how this scheme performs as the scal- 
ing factor A is increased, we compute 
the root-mean-square error (RMSE) 
and signal-to-noise ratio (PSNR) for 
the image difference matrix Az for 
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Fig. 6. Linear graph of diagonal element 
of the resultant vector (VV^) 

each value of A. If 6x^y represent the 
elements of Az, then the RMSE is 
defined as, 



-j m n 



(8) 




Fig. 7. Error between the original 
Lena image and the watermarked im- 
age (squares). Error between the wa- 
termark and extracted watermark (cir- 
cles), (a) PSNR {p) and (b) RMSE (e) 
as a function of A. 

show the results for (i) robustness 
against additive noise (ii) cropping 
(iii) JPEG compression. 



For the case of square image ar- 
rays considered in our simulations, 
m = n. We also define the Peak 
Signal-to-Noise Ratio (PSNR) as, 
p = 101ogio(max^,^/^). In Fig. (7), 
we show the p and s as a function of 
A. In this figure, the scaling factor A 
increases, there is an approximately 
linear increase in error as is to be ex- 
pected. Beyond about A = L2, the 
watermarked image becomes highly 
noisy. RMSE can be interpreted as 
the average error per pixel and it is 
seen that the error is only a small 
fraction of the pixel values. 



4^1 Additive Noise 



The noisy image Z can be repre- 
sented as. 



Z + G 



(9) 



where G is a random matrix of 
same order as Z with entries drawn 
from a standard Gaussian distribu- 
tion A^(0, a), where a is the variance. 




4 Robustness of the algorithm 




An important property of the wa- 
termarking algorithms is that they 
should be robust against several 
kinds of attacks. In this section, we 



Fig. 8. Noisy watermarked image with 
A = 0.2 (left) and recovered watermark 
(right). The PSNR error between wa- 
termark and the extracted watermark 
is p = 16.3 for a = 0.04. 
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Fig. 9. PSNR between the watermark 
and extracted watermark for different 
variance (a). 

Fig. (8) shows the result of ex- 
tracting watermark from the noisy 
Lena image. Our simulations indi- 
cate that the image difference be- 
tween watermark image and the one 
extracted from noisy image correlate 
well for a large range of A. Fig. (9) 
shows PSNR between the watermark 
and extracted watermark for differ- 
ent variance (a). It clearly indicates 
that as the variance of the Gaussian 
noise is increased the corresponding 
PSNR value decreases thereby lead- 
ing to a deterioration in the quality 
of the extracted image. 

4-2 Cropping 

Cropping is the process of removing 
certain parts of an image. Here, we 
subject the original Lena image to 
cropping and the cropped image is 
displayed in Fig. (10). The extracted 
watermark is also displayed along- 
side. We recall that in this method 
the information about the watermark 
is stored in every part of the original 
image. When the watermarked image 
is cropped and subjected to an ex- 
traction procedure, then the water- 
mark from the uncropped part sur- 



vives. By design, there is some loss 
of information. However, the surviv- 
ing part of the extracted watermark 
is very similar to the original water- 
mark. 




Fig. 10. Cropped Lena image (left) and 
the recovered watermark (right). 



4.3 JPEG Compression 

JPEG is one of the image encod- 
ing schemes that is currently pop- 
ular [Wallace (1991)]. It is a lossy 
compression technique that uses dis- 
crete cosine transform or the wavelet 
transform (2000 standard) as the 
work horse that ensures a compressed 
image [Christopoulos et al. (2000)]. 
We show that our watermarking 
scheme is robust against JPEG com- 
pression to a great extent. In figures 
(12-15), we show the watermark ex- 
tracted from JPEG compressed Lena 
image with various quality factors. 
Briefly, JPEG quality factor is an in- 
dication of the distortion, such that 
100% quality factor corresponds to 
least distortion. It is worth men- 
tioning here that, in our extraction 
algorithm as the JPEG quality in- 
creases the corresponding PSNR val- 
ues also increase leading to a bet- 
ter extracted image. This fact is de- 
picted in Fig. (11). This, in turn, cor- 
responds roughly to the amount of 
information retained after wavelet or 
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20 40 60 80 
JPEGQuality 



Fig. 16. original 
image 



Fig. 17. 

Watermark image 



Fig. 11. PSNR between the watermark 
and extracted watermark after JPEG 
compression. 





Fig. 12. JPEG 
Quality 90 
{p = 23.40) 



Fig. 13. JPEG 
Quality 70 
{p = 22.37) 





Fig. 14. JPEG 
Quality 50 
(p = 16.75) 



Fig. 15. JPEG 
Quality 30 
{p = 17.42) 



DCT decomposition. In Fig. (3), we 
apply our watermark embedding al- 
gorithm with A = 0.2 and we see that 
even at 50% and 30% JPEG qual- 
ity factors, the extracted watermark 
carries a reasonable resemblance of 
the original watermark image. The 
PSNR values of = | W - W| are 
provided as caption and as expected 
they decrease with the decrease in 
quality factor. Hence, the SVD based 
algorithm represented by equations 
(2-5) is robust against JPEG com- 
pression. 





Fig. 18. 

Watermarked 
image 



Fig. 19. Recovered 
watermark image 



5 Simulations for color image 



In Fig. (18), we show the simulations 
for the color images of Lena and the 
baboon. Clearly, at A = 0.02, the 
watermarked image does not show 
any sign of the underlying watermark 
and it is invisible. The watermarking 
and extraction algorithm presented 
in sections (2.1, 2.2) can be applied 
to color images as well. Since most of 
the robustness can be generalized in 
a straightforward way from those for 
the grey scale images, we do not show 
the results of those tests here. How- 
ever, we stress that the results of the 
robustness test are similar to the ones 
for the grey scale images presented 
above. 



6 Conclusions 



We have presented an algorithm for 
digital watermarking using singular 



value decomposition in the domain 
of the singular vectors of the image 
matrices. We have implemented our 
method for gray and color images and 
shown that the technique is robust 
against noise, cropping and JPEG 
compression. The advantage of our 
algorithm, as opposed to other SVD 
based techniques, lies in the fact that 
most of the previous methods rely on 
the singular values of the image ma- 
trix, thereby the information content 
of an n X n image was translated into 
just n values. In our approach, we 
use the scaled singular vectors to en- 
code the watermark. The technique 
also inherently contains a level of se- 
curity against the hacking of the wa- 
termark. 

The algorithm presented in the 
manuscript is not closed. In fact there 
can be certain modification to the al- 
gorithm such that various other as- 
pects can be included. For example, 
one can decrease the computational 
time of embedding and extracting the 
watermarks by a segmentation of the 
image. Then the algorithm can be ap- 
plied to these various segments indi- 
vidually. Apart from this the embed- 
ded image can be encrypted thereby 
enhancing the security of the image 
content. Here, not only image data, 
but also other data can be embed- 
ded in a cryptic form. Finally, it must 
be mentioned that in the present al- 
gorithm the scaling factor A is not 
wholly integrated into the algorithm, 
meaning if one does not possess the 
value A then, extraction of the image 
becomes difficult. To do away with 
this one can include the scaling factor 
inside the image matrix itself. Cur- 
rently the above mentioned features 



are under investigation and we hope 
to report them soon. 
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